#include "testlib.h"

RENDER(Request& context)
{
	u64 passed = 0;
	u64 failed = 0;
	u64 skipped = 0;
	auto check = [&](String name, bool ok, String detail)
	{
		site_tests_case(name, ok ? "pass" : "fail", detail);
		if(ok) passed++; else failed++;
	};
	site_tests_page_start("Structured crypto operations", "Algorithm-selected P-256 JWK creation and ES256 JWT signing.");
	DValue key_request;
	key_request["operation"] = "key_generate";
	key_request["algorithm"] = "ES256";
	DValue key = crypto_operation(key_request);
	DValue header;
	header["alg"] = "none";
	header["kid"] = key["kid"];
	DValue claims;
	claims["iss"] = "https://client.example";
	claims["sub"] = "client.example";
	DValue sign_request;
	sign_request["operation"] = "jwt_sign";
	sign_request["algorithm"] = "ES256";
	sign_request["private_jwk"] = key["private_jwk"];
	sign_request["protected_header"] = header;
	sign_request["claims"] = claims;
	DValue signed_result = crypto_operation(sign_request);
	String jwt = signed_result["jwt"].to_string();
	StringList parts = split(jwt, ".");
	String header_b64 = parts.size() == 3 ? parts[0] : "";
	while(header_b64.size() % 4) header_b64 += "=";
	String decoded_header = base64_decode(header_b64);
	DValue wrong_curve = key["private_jwk"];
	wrong_curve["crv"] = "P-384";
	DValue malformed = key["private_jwk"];
	malformed["x"] = "not_base64url=";
	DValue wrong_request = sign_request;
	wrong_request["private_jwk"] = wrong_curve;
	DValue malformed_request = sign_request;
	malformed_request["private_jwk"] = malformed;
	DValue cose_request;
	cose_request["operation"] = "cose_es256_parse";
	cose_request["algorithm"] = "ES256";
	cose_request["cose_key_base64url"] = "pQECAyYgASFYIGsX0fLhLEJH-Lzm5WOkQPJ3A32BLeszoPShOUXYmMKWIlggT-NC4v4af5uO5-tKfA-eFivOM1drMV7Oy7ZAaDe_UfU";
	DValue cose = crypto_operation(cose_request);
	DValue verify_request;
	verify_request["operation"] = "es256_verify";
	verify_request["algorithm"] = "ES256";
	verify_request["cose_key_base64url"] = cose_request["cose_key_base64url"];
	verify_request["message_base64url"] = "d2ViYXV0aG4gZml4ZWQgbWVzc2FnZQ";
	verify_request["signature_der_base64url"] = "MEUCIQCkatZK1VVsjk17uvyzyhjdAkMNWXPjxSOMqWcjmM_8XAIgDaSk3Qufyd0_6r9Dm9A8RQbFco-FdTBulq7bvRGoBC4";
	DValue unsupported;
	unsupported["operation"] = "encrypt";
	unsupported["algorithm"] = "ES256";
	DValue list_header;
	list_header.set_array();
	DValue list_item;
	list_item = "not-an-object";
	list_header.push(list_item);
	DValue list_request = sign_request;
	list_request["protected_header"] = list_header;
	DValue control_request = sign_request;
	control_request["claims"]["bad"] = String("control\nbyte");
	check("crypto_operation() generates an ES256 key", key["ok"].to_bool() && key["private_jwk"]["kty"].to_string() == "EC" && key["private_jwk"]["crv"].to_string() == "P-256" && key["public_jwk"]["d"].to_string() == "" && key["kid"].to_string() == key["thumbprint"].to_string(), key["kid"].to_string());
	check("crypto_operation() signs ES256 JWTs", signed_result["ok"].to_bool() && parts.size() == 3 && parts[2].size() == 86 && decoded_header.find("ES256") != String::npos, signed_result["error"].to_string());
	check("crypto_operation() rejects invalid signing requests", !crypto_operation(wrong_request)["ok"].to_bool() && !crypto_operation(malformed_request)["ok"].to_bool() && !crypto_operation(list_request)["ok"].to_bool() && crypto_operation(control_request)["error"].to_string() == "invalid_request", "signing validation");
	check("crypto_operation() parses an ES256 COSE key", cose["ok"].to_bool(), cose["error"].to_string());
	check("crypto_operation() verifies ES256 DER signatures", crypto_operation(verify_request)["ok"].to_bool() && crypto_operation(verify_request)["valid"].to_bool(), crypto_operation(verify_request)["error"].to_string());
	check("crypto_operation() rejects unsupported operations", crypto_operation(unsupported)["error"].to_string() == "unsupported_operation", crypto_operation(unsupported)["error"].to_string());
	site_tests_summary(passed, failed, skipped, "Structured crypto tests generate ephemeral P-256 keys and retain no key material.");
	site_tests_page_end();
}